Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Don't always insert data into keystore for tunnels

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-09-28 11:32:50 -07:00
parent 02ed03adaa
commit d0ef05c748
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/packet_analysis/protocol/ip/IP.cc
View file

@ -234,9 +234,6 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
bool return_val = true; bool return_val = true;
int proto = ip_hdr->NextProto(); int proto = ip_hdr->NextProto();
packet->key_store["ip_hdr"] = ip_hdr.get();
packet->key_store["proto"] = proto;
switch ( proto ) { switch ( proto ) {
case IPPROTO_TCP: case IPPROTO_TCP:
case IPPROTO_UDP: case IPPROTO_UDP:
@ -256,6 +253,10 @@ bool IPAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
} }
break; break;
default: default:
// The tunnel analyzer needs this data.
packet->key_store["ip_hdr"] = ip_hdr.get();
packet->key_store["proto"] = proto;
// For everything else, pass it on to another analyzer. If there's no one to handle that, // For everything else, pass it on to another analyzer. If there's no one to handle that,
// it'll report a Weird. // it'll report a Weird.
return_val = ForwardPacket(len, data, packet, proto); return_val = ForwardPacket(len, data, packet, proto);